xref: /freebsd/sys/dev/usb/wlan/if_ural.c (revision acc1a9ef8333c798c210fa94be6af4d5fe2dd794)
1 /*	$FreeBSD$	*/
2 
3 /*-
4  * Copyright (c) 2005, 2006
5  *	Damien Bergamini <damien.bergamini@free.fr>
6  *
7  * Copyright (c) 2006, 2008
8  *	Hans Petter Selasky <hselasky@FreeBSD.org>
9  *
10  * Permission to use, copy, modify, and distribute this software for any
11  * purpose with or without fee is hereby granted, provided that the above
12  * copyright notice and this permission notice appear in all copies.
13  *
14  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
15  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
16  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
17  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
18  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
19  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
20  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
21  */
22 
23 #include <sys/cdefs.h>
24 __FBSDID("$FreeBSD$");
25 
26 /*-
27  * Ralink Technology RT2500USB chipset driver
28  * http://www.ralinktech.com/
29  */
30 
31 #include <sys/param.h>
32 #include <sys/sockio.h>
33 #include <sys/sysctl.h>
34 #include <sys/lock.h>
35 #include <sys/mutex.h>
36 #include <sys/mbuf.h>
37 #include <sys/kernel.h>
38 #include <sys/socket.h>
39 #include <sys/systm.h>
40 #include <sys/malloc.h>
41 #include <sys/module.h>
42 #include <sys/bus.h>
43 #include <sys/endian.h>
44 #include <sys/kdb.h>
45 
46 #include <machine/bus.h>
47 #include <machine/resource.h>
48 #include <sys/rman.h>
49 
50 #include <net/bpf.h>
51 #include <net/if.h>
52 #include <net/if_var.h>
53 #include <net/if_arp.h>
54 #include <net/ethernet.h>
55 #include <net/if_dl.h>
56 #include <net/if_media.h>
57 #include <net/if_types.h>
58 
59 #ifdef INET
60 #include <netinet/in.h>
61 #include <netinet/in_systm.h>
62 #include <netinet/in_var.h>
63 #include <netinet/if_ether.h>
64 #include <netinet/ip.h>
65 #endif
66 
67 #include <net80211/ieee80211_var.h>
68 #include <net80211/ieee80211_regdomain.h>
69 #include <net80211/ieee80211_radiotap.h>
70 #include <net80211/ieee80211_ratectl.h>
71 
72 #include <dev/usb/usb.h>
73 #include <dev/usb/usbdi.h>
74 #include "usbdevs.h"
75 
76 #define	USB_DEBUG_VAR ural_debug
77 #include <dev/usb/usb_debug.h>
78 
79 #include <dev/usb/wlan/if_uralreg.h>
80 #include <dev/usb/wlan/if_uralvar.h>
81 
82 #ifdef USB_DEBUG
83 static int ural_debug = 0;
84 
85 static SYSCTL_NODE(_hw_usb, OID_AUTO, ural, CTLFLAG_RW, 0, "USB ural");
86 SYSCTL_INT(_hw_usb_ural, OID_AUTO, debug, CTLFLAG_RWTUN, &ural_debug, 0,
87     "Debug level");
88 #endif
89 
90 #define URAL_RSSI(rssi)					\
91 	((rssi) > (RAL_NOISE_FLOOR + RAL_RSSI_CORR) ?	\
92 	 ((rssi) - (RAL_NOISE_FLOOR + RAL_RSSI_CORR)) : 0)
93 
94 /* various supported device vendors/products */
95 static const STRUCT_USB_HOST_ID ural_devs[] = {
96 #define	URAL_DEV(v,p)  { USB_VP(USB_VENDOR_##v, USB_PRODUCT_##v##_##p) }
97 	URAL_DEV(ASUS, WL167G),
98 	URAL_DEV(ASUS, RT2570),
99 	URAL_DEV(BELKIN, F5D7050),
100 	URAL_DEV(BELKIN, F5D7051),
101 	URAL_DEV(CISCOLINKSYS, HU200TS),
102 	URAL_DEV(CISCOLINKSYS, WUSB54G),
103 	URAL_DEV(CISCOLINKSYS, WUSB54GP),
104 	URAL_DEV(CONCEPTRONIC2, C54RU),
105 	URAL_DEV(DLINK, DWLG122),
106 	URAL_DEV(GIGABYTE, GN54G),
107 	URAL_DEV(GIGABYTE, GNWBKG),
108 	URAL_DEV(GUILLEMOT, HWGUSB254),
109 	URAL_DEV(MELCO, KG54),
110 	URAL_DEV(MELCO, KG54AI),
111 	URAL_DEV(MELCO, KG54YB),
112 	URAL_DEV(MELCO, NINWIFI),
113 	URAL_DEV(MSI, RT2570),
114 	URAL_DEV(MSI, RT2570_2),
115 	URAL_DEV(MSI, RT2570_3),
116 	URAL_DEV(NOVATECH, NV902),
117 	URAL_DEV(RALINK, RT2570),
118 	URAL_DEV(RALINK, RT2570_2),
119 	URAL_DEV(RALINK, RT2570_3),
120 	URAL_DEV(SIEMENS2, WL54G),
121 	URAL_DEV(SMC, 2862WG),
122 	URAL_DEV(SPHAIRON, UB801R),
123 	URAL_DEV(SURECOM, RT2570),
124 	URAL_DEV(VTECH, RT2570),
125 	URAL_DEV(ZINWELL, RT2570),
126 #undef URAL_DEV
127 };
128 
129 static usb_callback_t ural_bulk_read_callback;
130 static usb_callback_t ural_bulk_write_callback;
131 
132 static usb_error_t	ural_do_request(struct ural_softc *sc,
133 			    struct usb_device_request *req, void *data);
134 static struct ieee80211vap *ural_vap_create(struct ieee80211com *,
135 			    const char [IFNAMSIZ], int, enum ieee80211_opmode,
136 			    int, const uint8_t [IEEE80211_ADDR_LEN],
137 			    const uint8_t [IEEE80211_ADDR_LEN]);
138 static void		ural_vap_delete(struct ieee80211vap *);
139 static void		ural_tx_free(struct ural_tx_data *, int);
140 static void		ural_setup_tx_list(struct ural_softc *);
141 static void		ural_unsetup_tx_list(struct ural_softc *);
142 static int		ural_newstate(struct ieee80211vap *,
143 			    enum ieee80211_state, int);
144 static void		ural_setup_tx_desc(struct ural_softc *,
145 			    struct ural_tx_desc *, uint32_t, int, int);
146 static int		ural_tx_bcn(struct ural_softc *, struct mbuf *,
147 			    struct ieee80211_node *);
148 static int		ural_tx_mgt(struct ural_softc *, struct mbuf *,
149 			    struct ieee80211_node *);
150 static int		ural_tx_data(struct ural_softc *, struct mbuf *,
151 			    struct ieee80211_node *);
152 static int		ural_transmit(struct ieee80211com *, struct mbuf *);
153 static void		ural_start(struct ural_softc *);
154 static void		ural_parent(struct ieee80211com *);
155 static void		ural_set_testmode(struct ural_softc *);
156 static void		ural_eeprom_read(struct ural_softc *, uint16_t, void *,
157 			    int);
158 static uint16_t		ural_read(struct ural_softc *, uint16_t);
159 static void		ural_read_multi(struct ural_softc *, uint16_t, void *,
160 			    int);
161 static void		ural_write(struct ural_softc *, uint16_t, uint16_t);
162 static void		ural_write_multi(struct ural_softc *, uint16_t, void *,
163 			    int) __unused;
164 static void		ural_bbp_write(struct ural_softc *, uint8_t, uint8_t);
165 static uint8_t		ural_bbp_read(struct ural_softc *, uint8_t);
166 static void		ural_rf_write(struct ural_softc *, uint8_t, uint32_t);
167 static void		ural_scan_start(struct ieee80211com *);
168 static void		ural_scan_end(struct ieee80211com *);
169 static void		ural_set_channel(struct ieee80211com *);
170 static void		ural_set_chan(struct ural_softc *,
171 			    struct ieee80211_channel *);
172 static void		ural_disable_rf_tune(struct ural_softc *);
173 static void		ural_enable_tsf_sync(struct ural_softc *);
174 static void 		ural_enable_tsf(struct ural_softc *);
175 static void		ural_update_slot(struct ural_softc *);
176 static void		ural_set_txpreamble(struct ural_softc *);
177 static void		ural_set_basicrates(struct ural_softc *,
178 			    const struct ieee80211_channel *);
179 static void		ural_set_bssid(struct ural_softc *, const uint8_t *);
180 static void		ural_set_macaddr(struct ural_softc *, const uint8_t *);
181 static void		ural_update_promisc(struct ieee80211com *);
182 static void		ural_setpromisc(struct ural_softc *);
183 static const char	*ural_get_rf(int);
184 static void		ural_read_eeprom(struct ural_softc *);
185 static int		ural_bbp_init(struct ural_softc *);
186 static void		ural_set_txantenna(struct ural_softc *, int);
187 static void		ural_set_rxantenna(struct ural_softc *, int);
188 static void		ural_init(struct ural_softc *);
189 static void		ural_stop(struct ural_softc *);
190 static int		ural_raw_xmit(struct ieee80211_node *, struct mbuf *,
191 			    const struct ieee80211_bpf_params *);
192 static void		ural_ratectl_start(struct ural_softc *,
193 			    struct ieee80211_node *);
194 static void		ural_ratectl_timeout(void *);
195 static void		ural_ratectl_task(void *, int);
196 static int		ural_pause(struct ural_softc *sc, int timeout);
197 
198 /*
199  * Default values for MAC registers; values taken from the reference driver.
200  */
201 static const struct {
202 	uint16_t	reg;
203 	uint16_t	val;
204 } ural_def_mac[] = {
205 	{ RAL_TXRX_CSR5,  0x8c8d },
206 	{ RAL_TXRX_CSR6,  0x8b8a },
207 	{ RAL_TXRX_CSR7,  0x8687 },
208 	{ RAL_TXRX_CSR8,  0x0085 },
209 	{ RAL_MAC_CSR13,  0x1111 },
210 	{ RAL_MAC_CSR14,  0x1e11 },
211 	{ RAL_TXRX_CSR21, 0xe78f },
212 	{ RAL_MAC_CSR9,   0xff1d },
213 	{ RAL_MAC_CSR11,  0x0002 },
214 	{ RAL_MAC_CSR22,  0x0053 },
215 	{ RAL_MAC_CSR15,  0x0000 },
216 	{ RAL_MAC_CSR8,   RAL_FRAME_SIZE },
217 	{ RAL_TXRX_CSR19, 0x0000 },
218 	{ RAL_TXRX_CSR18, 0x005a },
219 	{ RAL_PHY_CSR2,   0x0000 },
220 	{ RAL_TXRX_CSR0,  0x1ec0 },
221 	{ RAL_PHY_CSR4,   0x000f }
222 };
223 
224 /*
225  * Default values for BBP registers; values taken from the reference driver.
226  */
227 static const struct {
228 	uint8_t	reg;
229 	uint8_t	val;
230 } ural_def_bbp[] = {
231 	{  3, 0x02 },
232 	{  4, 0x19 },
233 	{ 14, 0x1c },
234 	{ 15, 0x30 },
235 	{ 16, 0xac },
236 	{ 17, 0x48 },
237 	{ 18, 0x18 },
238 	{ 19, 0xff },
239 	{ 20, 0x1e },
240 	{ 21, 0x08 },
241 	{ 22, 0x08 },
242 	{ 23, 0x08 },
243 	{ 24, 0x80 },
244 	{ 25, 0x50 },
245 	{ 26, 0x08 },
246 	{ 27, 0x23 },
247 	{ 30, 0x10 },
248 	{ 31, 0x2b },
249 	{ 32, 0xb9 },
250 	{ 34, 0x12 },
251 	{ 35, 0x50 },
252 	{ 39, 0xc4 },
253 	{ 40, 0x02 },
254 	{ 41, 0x60 },
255 	{ 53, 0x10 },
256 	{ 54, 0x18 },
257 	{ 56, 0x08 },
258 	{ 57, 0x10 },
259 	{ 58, 0x08 },
260 	{ 61, 0x60 },
261 	{ 62, 0x10 },
262 	{ 75, 0xff }
263 };
264 
265 /*
266  * Default values for RF register R2 indexed by channel numbers.
267  */
268 static const uint32_t ural_rf2522_r2[] = {
269 	0x307f6, 0x307fb, 0x30800, 0x30805, 0x3080a, 0x3080f, 0x30814,
270 	0x30819, 0x3081e, 0x30823, 0x30828, 0x3082d, 0x30832, 0x3083e
271 };
272 
273 static const uint32_t ural_rf2523_r2[] = {
274 	0x00327, 0x00328, 0x00329, 0x0032a, 0x0032b, 0x0032c, 0x0032d,
275 	0x0032e, 0x0032f, 0x00340, 0x00341, 0x00342, 0x00343, 0x00346
276 };
277 
278 static const uint32_t ural_rf2524_r2[] = {
279 	0x00327, 0x00328, 0x00329, 0x0032a, 0x0032b, 0x0032c, 0x0032d,
280 	0x0032e, 0x0032f, 0x00340, 0x00341, 0x00342, 0x00343, 0x00346
281 };
282 
283 static const uint32_t ural_rf2525_r2[] = {
284 	0x20327, 0x20328, 0x20329, 0x2032a, 0x2032b, 0x2032c, 0x2032d,
285 	0x2032e, 0x2032f, 0x20340, 0x20341, 0x20342, 0x20343, 0x20346
286 };
287 
288 static const uint32_t ural_rf2525_hi_r2[] = {
289 	0x2032f, 0x20340, 0x20341, 0x20342, 0x20343, 0x20344, 0x20345,
290 	0x20346, 0x20347, 0x20348, 0x20349, 0x2034a, 0x2034b, 0x2034e
291 };
292 
293 static const uint32_t ural_rf2525e_r2[] = {
294 	0x2044d, 0x2044e, 0x2044f, 0x20460, 0x20461, 0x20462, 0x20463,
295 	0x20464, 0x20465, 0x20466, 0x20467, 0x20468, 0x20469, 0x2046b
296 };
297 
298 static const uint32_t ural_rf2526_hi_r2[] = {
299 	0x0022a, 0x0022b, 0x0022b, 0x0022c, 0x0022c, 0x0022d, 0x0022d,
300 	0x0022e, 0x0022e, 0x0022f, 0x0022d, 0x00240, 0x00240, 0x00241
301 };
302 
303 static const uint32_t ural_rf2526_r2[] = {
304 	0x00226, 0x00227, 0x00227, 0x00228, 0x00228, 0x00229, 0x00229,
305 	0x0022a, 0x0022a, 0x0022b, 0x0022b, 0x0022c, 0x0022c, 0x0022d
306 };
307 
308 /*
309  * For dual-band RF, RF registers R1 and R4 also depend on channel number;
310  * values taken from the reference driver.
311  */
312 static const struct {
313 	uint8_t		chan;
314 	uint32_t	r1;
315 	uint32_t	r2;
316 	uint32_t	r4;
317 } ural_rf5222[] = {
318 	{   1, 0x08808, 0x0044d, 0x00282 },
319 	{   2, 0x08808, 0x0044e, 0x00282 },
320 	{   3, 0x08808, 0x0044f, 0x00282 },
321 	{   4, 0x08808, 0x00460, 0x00282 },
322 	{   5, 0x08808, 0x00461, 0x00282 },
323 	{   6, 0x08808, 0x00462, 0x00282 },
324 	{   7, 0x08808, 0x00463, 0x00282 },
325 	{   8, 0x08808, 0x00464, 0x00282 },
326 	{   9, 0x08808, 0x00465, 0x00282 },
327 	{  10, 0x08808, 0x00466, 0x00282 },
328 	{  11, 0x08808, 0x00467, 0x00282 },
329 	{  12, 0x08808, 0x00468, 0x00282 },
330 	{  13, 0x08808, 0x00469, 0x00282 },
331 	{  14, 0x08808, 0x0046b, 0x00286 },
332 
333 	{  36, 0x08804, 0x06225, 0x00287 },
334 	{  40, 0x08804, 0x06226, 0x00287 },
335 	{  44, 0x08804, 0x06227, 0x00287 },
336 	{  48, 0x08804, 0x06228, 0x00287 },
337 	{  52, 0x08804, 0x06229, 0x00287 },
338 	{  56, 0x08804, 0x0622a, 0x00287 },
339 	{  60, 0x08804, 0x0622b, 0x00287 },
340 	{  64, 0x08804, 0x0622c, 0x00287 },
341 
342 	{ 100, 0x08804, 0x02200, 0x00283 },
343 	{ 104, 0x08804, 0x02201, 0x00283 },
344 	{ 108, 0x08804, 0x02202, 0x00283 },
345 	{ 112, 0x08804, 0x02203, 0x00283 },
346 	{ 116, 0x08804, 0x02204, 0x00283 },
347 	{ 120, 0x08804, 0x02205, 0x00283 },
348 	{ 124, 0x08804, 0x02206, 0x00283 },
349 	{ 128, 0x08804, 0x02207, 0x00283 },
350 	{ 132, 0x08804, 0x02208, 0x00283 },
351 	{ 136, 0x08804, 0x02209, 0x00283 },
352 	{ 140, 0x08804, 0x0220a, 0x00283 },
353 
354 	{ 149, 0x08808, 0x02429, 0x00281 },
355 	{ 153, 0x08808, 0x0242b, 0x00281 },
356 	{ 157, 0x08808, 0x0242d, 0x00281 },
357 	{ 161, 0x08808, 0x0242f, 0x00281 }
358 };
359 
360 static const struct usb_config ural_config[URAL_N_TRANSFER] = {
361 	[URAL_BULK_WR] = {
362 		.type = UE_BULK,
363 		.endpoint = UE_ADDR_ANY,
364 		.direction = UE_DIR_OUT,
365 		.bufsize = (RAL_FRAME_SIZE + RAL_TX_DESC_SIZE + 4),
366 		.flags = {.pipe_bof = 1,.force_short_xfer = 1,},
367 		.callback = ural_bulk_write_callback,
368 		.timeout = 5000,	/* ms */
369 	},
370 	[URAL_BULK_RD] = {
371 		.type = UE_BULK,
372 		.endpoint = UE_ADDR_ANY,
373 		.direction = UE_DIR_IN,
374 		.bufsize = (RAL_FRAME_SIZE + RAL_RX_DESC_SIZE),
375 		.flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
376 		.callback = ural_bulk_read_callback,
377 	},
378 };
379 
380 static device_probe_t ural_match;
381 static device_attach_t ural_attach;
382 static device_detach_t ural_detach;
383 
384 static device_method_t ural_methods[] = {
385 	/* Device interface */
386 	DEVMETHOD(device_probe,		ural_match),
387 	DEVMETHOD(device_attach,	ural_attach),
388 	DEVMETHOD(device_detach,	ural_detach),
389 	DEVMETHOD_END
390 };
391 
392 static driver_t ural_driver = {
393 	.name = "ural",
394 	.methods = ural_methods,
395 	.size = sizeof(struct ural_softc),
396 };
397 
398 static devclass_t ural_devclass;
399 
400 DRIVER_MODULE(ural, uhub, ural_driver, ural_devclass, NULL, 0);
401 MODULE_DEPEND(ural, usb, 1, 1, 1);
402 MODULE_DEPEND(ural, wlan, 1, 1, 1);
403 MODULE_VERSION(ural, 1);
404 USB_PNP_HOST_INFO(ural_devs);
405 
406 static int
407 ural_match(device_t self)
408 {
409 	struct usb_attach_arg *uaa = device_get_ivars(self);
410 
411 	if (uaa->usb_mode != USB_MODE_HOST)
412 		return (ENXIO);
413 	if (uaa->info.bConfigIndex != 0)
414 		return (ENXIO);
415 	if (uaa->info.bIfaceIndex != RAL_IFACE_INDEX)
416 		return (ENXIO);
417 
418 	return (usbd_lookup_id_by_uaa(ural_devs, sizeof(ural_devs), uaa));
419 }
420 
421 static int
422 ural_attach(device_t self)
423 {
424 	struct usb_attach_arg *uaa = device_get_ivars(self);
425 	struct ural_softc *sc = device_get_softc(self);
426 	struct ieee80211com *ic = &sc->sc_ic;
427 	uint8_t bands[howmany(IEEE80211_MODE_MAX, 8)];
428 	uint8_t iface_index;
429 	int error;
430 
431 	device_set_usb_desc(self);
432 	sc->sc_udev = uaa->device;
433 	sc->sc_dev = self;
434 
435 	mtx_init(&sc->sc_mtx, device_get_nameunit(self),
436 	    MTX_NETWORK_LOCK, MTX_DEF);
437 	mbufq_init(&sc->sc_snd, ifqmaxlen);
438 
439 	iface_index = RAL_IFACE_INDEX;
440 	error = usbd_transfer_setup(uaa->device,
441 	    &iface_index, sc->sc_xfer, ural_config,
442 	    URAL_N_TRANSFER, sc, &sc->sc_mtx);
443 	if (error) {
444 		device_printf(self, "could not allocate USB transfers, "
445 		    "err=%s\n", usbd_errstr(error));
446 		goto detach;
447 	}
448 
449 	RAL_LOCK(sc);
450 	/* retrieve RT2570 rev. no */
451 	sc->asic_rev = ural_read(sc, RAL_MAC_CSR0);
452 
453 	/* retrieve MAC address and various other things from EEPROM */
454 	ural_read_eeprom(sc);
455 	RAL_UNLOCK(sc);
456 
457 	device_printf(self, "MAC/BBP RT2570 (rev 0x%02x), RF %s\n",
458 	    sc->asic_rev, ural_get_rf(sc->rf_rev));
459 
460 	ic->ic_softc = sc;
461 	ic->ic_name = device_get_nameunit(self);
462 	ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
463 
464 	/* set device capabilities */
465 	ic->ic_caps =
466 	      IEEE80211_C_STA		/* station mode supported */
467 	    | IEEE80211_C_IBSS		/* IBSS mode supported */
468 	    | IEEE80211_C_MONITOR	/* monitor mode supported */
469 	    | IEEE80211_C_HOSTAP	/* HostAp mode supported */
470 	    | IEEE80211_C_TXPMGT	/* tx power management */
471 	    | IEEE80211_C_SHPREAMBLE	/* short preamble supported */
472 	    | IEEE80211_C_SHSLOT	/* short slot time supported */
473 	    | IEEE80211_C_BGSCAN	/* bg scanning supported */
474 	    | IEEE80211_C_WPA		/* 802.11i */
475 	    ;
476 
477 	memset(bands, 0, sizeof(bands));
478 	setbit(bands, IEEE80211_MODE_11B);
479 	setbit(bands, IEEE80211_MODE_11G);
480 	if (sc->rf_rev == RAL_RF_5222)
481 		setbit(bands, IEEE80211_MODE_11A);
482 	ieee80211_init_channels(ic, NULL, bands);
483 
484 	ieee80211_ifattach(ic);
485 	ic->ic_update_promisc = ural_update_promisc;
486 	ic->ic_raw_xmit = ural_raw_xmit;
487 	ic->ic_scan_start = ural_scan_start;
488 	ic->ic_scan_end = ural_scan_end;
489 	ic->ic_set_channel = ural_set_channel;
490 	ic->ic_parent = ural_parent;
491 	ic->ic_transmit = ural_transmit;
492 	ic->ic_vap_create = ural_vap_create;
493 	ic->ic_vap_delete = ural_vap_delete;
494 
495 	ieee80211_radiotap_attach(ic,
496 	    &sc->sc_txtap.wt_ihdr, sizeof(sc->sc_txtap),
497 		RAL_TX_RADIOTAP_PRESENT,
498 	    &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
499 		RAL_RX_RADIOTAP_PRESENT);
500 
501 	if (bootverbose)
502 		ieee80211_announce(ic);
503 
504 	return (0);
505 
506 detach:
507 	ural_detach(self);
508 	return (ENXIO);			/* failure */
509 }
510 
511 static int
512 ural_detach(device_t self)
513 {
514 	struct ural_softc *sc = device_get_softc(self);
515 	struct ieee80211com *ic = &sc->sc_ic;
516 
517 	/* prevent further ioctls */
518 	RAL_LOCK(sc);
519 	sc->sc_detached = 1;
520 	RAL_UNLOCK(sc);
521 
522 	/* stop all USB transfers */
523 	usbd_transfer_unsetup(sc->sc_xfer, URAL_N_TRANSFER);
524 
525 	/* free TX list, if any */
526 	RAL_LOCK(sc);
527 	ural_unsetup_tx_list(sc);
528 	RAL_UNLOCK(sc);
529 
530 	if (ic->ic_softc == sc)
531 		ieee80211_ifdetach(ic);
532 	mbufq_drain(&sc->sc_snd);
533 	mtx_destroy(&sc->sc_mtx);
534 
535 	return (0);
536 }
537 
538 static usb_error_t
539 ural_do_request(struct ural_softc *sc,
540     struct usb_device_request *req, void *data)
541 {
542 	usb_error_t err;
543 	int ntries = 10;
544 
545 	while (ntries--) {
546 		err = usbd_do_request_flags(sc->sc_udev, &sc->sc_mtx,
547 		    req, data, 0, NULL, 250 /* ms */);
548 		if (err == 0)
549 			break;
550 
551 		DPRINTFN(1, "Control request failed, %s (retrying)\n",
552 		    usbd_errstr(err));
553 		if (ural_pause(sc, hz / 100))
554 			break;
555 	}
556 	return (err);
557 }
558 
559 static struct ieee80211vap *
560 ural_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
561     enum ieee80211_opmode opmode, int flags,
562     const uint8_t bssid[IEEE80211_ADDR_LEN],
563     const uint8_t mac[IEEE80211_ADDR_LEN])
564 {
565 	struct ural_softc *sc = ic->ic_softc;
566 	struct ural_vap *uvp;
567 	struct ieee80211vap *vap;
568 
569 	if (!TAILQ_EMPTY(&ic->ic_vaps))		/* only one at a time */
570 		return NULL;
571 	uvp = malloc(sizeof(struct ural_vap), M_80211_VAP, M_WAITOK | M_ZERO);
572 	vap = &uvp->vap;
573 	/* enable s/w bmiss handling for sta mode */
574 
575 	if (ieee80211_vap_setup(ic, vap, name, unit, opmode,
576 	    flags | IEEE80211_CLONE_NOBEACONS, bssid) != 0) {
577 		/* out of memory */
578 		free(uvp, M_80211_VAP);
579 		return (NULL);
580 	}
581 
582 	/* override state transition machine */
583 	uvp->newstate = vap->iv_newstate;
584 	vap->iv_newstate = ural_newstate;
585 
586 	usb_callout_init_mtx(&uvp->ratectl_ch, &sc->sc_mtx, 0);
587 	TASK_INIT(&uvp->ratectl_task, 0, ural_ratectl_task, uvp);
588 	ieee80211_ratectl_init(vap);
589 	ieee80211_ratectl_setinterval(vap, 1000 /* 1 sec */);
590 
591 	/* complete setup */
592 	ieee80211_vap_attach(vap, ieee80211_media_change,
593 	    ieee80211_media_status, mac);
594 	ic->ic_opmode = opmode;
595 	return vap;
596 }
597 
598 static void
599 ural_vap_delete(struct ieee80211vap *vap)
600 {
601 	struct ural_vap *uvp = URAL_VAP(vap);
602 	struct ieee80211com *ic = vap->iv_ic;
603 
604 	usb_callout_drain(&uvp->ratectl_ch);
605 	ieee80211_draintask(ic, &uvp->ratectl_task);
606 	ieee80211_ratectl_deinit(vap);
607 	ieee80211_vap_detach(vap);
608 	free(uvp, M_80211_VAP);
609 }
610 
611 static void
612 ural_tx_free(struct ural_tx_data *data, int txerr)
613 {
614 	struct ural_softc *sc = data->sc;
615 
616 	if (data->m != NULL) {
617 		ieee80211_tx_complete(data->ni, data->m, txerr);
618 		data->m = NULL;
619 		data->ni = NULL;
620 	}
621 	STAILQ_INSERT_TAIL(&sc->tx_free, data, next);
622 	sc->tx_nfree++;
623 }
624 
625 static void
626 ural_setup_tx_list(struct ural_softc *sc)
627 {
628 	struct ural_tx_data *data;
629 	int i;
630 
631 	sc->tx_nfree = 0;
632 	STAILQ_INIT(&sc->tx_q);
633 	STAILQ_INIT(&sc->tx_free);
634 
635 	for (i = 0; i < RAL_TX_LIST_COUNT; i++) {
636 		data = &sc->tx_data[i];
637 
638 		data->sc = sc;
639 		STAILQ_INSERT_TAIL(&sc->tx_free, data, next);
640 		sc->tx_nfree++;
641 	}
642 }
643 
644 static void
645 ural_unsetup_tx_list(struct ural_softc *sc)
646 {
647 	struct ural_tx_data *data;
648 	int i;
649 
650 	/* make sure any subsequent use of the queues will fail */
651 	sc->tx_nfree = 0;
652 	STAILQ_INIT(&sc->tx_q);
653 	STAILQ_INIT(&sc->tx_free);
654 
655 	/* free up all node references and mbufs */
656 	for (i = 0; i < RAL_TX_LIST_COUNT; i++) {
657 		data = &sc->tx_data[i];
658 
659 		if (data->m != NULL) {
660 			m_freem(data->m);
661 			data->m = NULL;
662 		}
663 		if (data->ni != NULL) {
664 			ieee80211_free_node(data->ni);
665 			data->ni = NULL;
666 		}
667 	}
668 }
669 
670 static int
671 ural_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
672 {
673 	struct ural_vap *uvp = URAL_VAP(vap);
674 	struct ieee80211com *ic = vap->iv_ic;
675 	struct ural_softc *sc = ic->ic_softc;
676 	const struct ieee80211_txparam *tp;
677 	struct ieee80211_node *ni;
678 	struct mbuf *m;
679 
680 	DPRINTF("%s -> %s\n",
681 		ieee80211_state_name[vap->iv_state],
682 		ieee80211_state_name[nstate]);
683 
684 	IEEE80211_UNLOCK(ic);
685 	RAL_LOCK(sc);
686 	usb_callout_stop(&uvp->ratectl_ch);
687 
688 	switch (nstate) {
689 	case IEEE80211_S_INIT:
690 		if (vap->iv_state == IEEE80211_S_RUN) {
691 			/* abort TSF synchronization */
692 			ural_write(sc, RAL_TXRX_CSR19, 0);
693 
694 			/* force tx led to stop blinking */
695 			ural_write(sc, RAL_MAC_CSR20, 0);
696 		}
697 		break;
698 
699 	case IEEE80211_S_RUN:
700 		ni = ieee80211_ref_node(vap->iv_bss);
701 
702 		if (vap->iv_opmode != IEEE80211_M_MONITOR) {
703 			if (ic->ic_bsschan == IEEE80211_CHAN_ANYC)
704 				goto fail;
705 
706 			ural_update_slot(sc);
707 			ural_set_txpreamble(sc);
708 			ural_set_basicrates(sc, ic->ic_bsschan);
709 			IEEE80211_ADDR_COPY(sc->sc_bssid, ni->ni_bssid);
710 			ural_set_bssid(sc, sc->sc_bssid);
711 		}
712 
713 		if (vap->iv_opmode == IEEE80211_M_HOSTAP ||
714 		    vap->iv_opmode == IEEE80211_M_IBSS) {
715 			m = ieee80211_beacon_alloc(ni);
716 			if (m == NULL) {
717 				device_printf(sc->sc_dev,
718 				    "could not allocate beacon\n");
719 				goto fail;
720 			}
721 			ieee80211_ref_node(ni);
722 			if (ural_tx_bcn(sc, m, ni) != 0) {
723 				device_printf(sc->sc_dev,
724 				    "could not send beacon\n");
725 				goto fail;
726 			}
727 		}
728 
729 		/* make tx led blink on tx (controlled by ASIC) */
730 		ural_write(sc, RAL_MAC_CSR20, 1);
731 
732 		if (vap->iv_opmode != IEEE80211_M_MONITOR)
733 			ural_enable_tsf_sync(sc);
734 		else
735 			ural_enable_tsf(sc);
736 
737 		/* enable automatic rate adaptation */
738 		/* XXX should use ic_bsschan but not valid until after newstate call below */
739 		tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
740 		if (tp->ucastrate == IEEE80211_FIXED_RATE_NONE)
741 			ural_ratectl_start(sc, ni);
742 		ieee80211_free_node(ni);
743 		break;
744 
745 	default:
746 		break;
747 	}
748 	RAL_UNLOCK(sc);
749 	IEEE80211_LOCK(ic);
750 	return (uvp->newstate(vap, nstate, arg));
751 
752 fail:
753 	RAL_UNLOCK(sc);
754 	IEEE80211_LOCK(ic);
755 	ieee80211_free_node(ni);
756 	return (-1);
757 }
758 
759 
760 static void
761 ural_bulk_write_callback(struct usb_xfer *xfer, usb_error_t error)
762 {
763 	struct ural_softc *sc = usbd_xfer_softc(xfer);
764 	struct ieee80211vap *vap;
765 	struct ural_tx_data *data;
766 	struct mbuf *m;
767 	struct usb_page_cache *pc;
768 	int len;
769 
770 	usbd_xfer_status(xfer, &len, NULL, NULL, NULL);
771 
772 	switch (USB_GET_STATE(xfer)) {
773 	case USB_ST_TRANSFERRED:
774 		DPRINTFN(11, "transfer complete, %d bytes\n", len);
775 
776 		/* free resources */
777 		data = usbd_xfer_get_priv(xfer);
778 		ural_tx_free(data, 0);
779 		usbd_xfer_set_priv(xfer, NULL);
780 
781 		/* FALLTHROUGH */
782 	case USB_ST_SETUP:
783 tr_setup:
784 		data = STAILQ_FIRST(&sc->tx_q);
785 		if (data) {
786 			STAILQ_REMOVE_HEAD(&sc->tx_q, next);
787 			m = data->m;
788 
789 			if (m->m_pkthdr.len > (int)(RAL_FRAME_SIZE + RAL_TX_DESC_SIZE)) {
790 				DPRINTFN(0, "data overflow, %u bytes\n",
791 				    m->m_pkthdr.len);
792 				m->m_pkthdr.len = (RAL_FRAME_SIZE + RAL_TX_DESC_SIZE);
793 			}
794 			pc = usbd_xfer_get_frame(xfer, 0);
795 			usbd_copy_in(pc, 0, &data->desc, RAL_TX_DESC_SIZE);
796 			usbd_m_copy_in(pc, RAL_TX_DESC_SIZE, m, 0,
797 			    m->m_pkthdr.len);
798 
799 			vap = data->ni->ni_vap;
800 			if (ieee80211_radiotap_active_vap(vap)) {
801 				struct ural_tx_radiotap_header *tap = &sc->sc_txtap;
802 
803 				tap->wt_flags = 0;
804 				tap->wt_rate = data->rate;
805 				tap->wt_antenna = sc->tx_ant;
806 
807 				ieee80211_radiotap_tx(vap, m);
808 			}
809 
810 			/* xfer length needs to be a multiple of two! */
811 			len = (RAL_TX_DESC_SIZE + m->m_pkthdr.len + 1) & ~1;
812 			if ((len % 64) == 0)
813 				len += 2;
814 
815 			DPRINTFN(11, "sending frame len=%u xferlen=%u\n",
816 			    m->m_pkthdr.len, len);
817 
818 			usbd_xfer_set_frame_len(xfer, 0, len);
819 			usbd_xfer_set_priv(xfer, data);
820 
821 			usbd_transfer_submit(xfer);
822 		}
823 		ural_start(sc);
824 		break;
825 
826 	default:			/* Error */
827 		DPRINTFN(11, "transfer error, %s\n",
828 		    usbd_errstr(error));
829 
830 		data = usbd_xfer_get_priv(xfer);
831 		if (data != NULL) {
832 			ural_tx_free(data, error);
833 			usbd_xfer_set_priv(xfer, NULL);
834 		}
835 
836 		if (error == USB_ERR_STALLED) {
837 			/* try to clear stall first */
838 			usbd_xfer_set_stall(xfer);
839 			goto tr_setup;
840 		}
841 		if (error == USB_ERR_TIMEOUT)
842 			device_printf(sc->sc_dev, "device timeout\n");
843 		break;
844 	}
845 }
846 
847 static void
848 ural_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error)
849 {
850 	struct ural_softc *sc = usbd_xfer_softc(xfer);
851 	struct ieee80211com *ic = &sc->sc_ic;
852 	struct ieee80211_node *ni;
853 	struct mbuf *m = NULL;
854 	struct usb_page_cache *pc;
855 	uint32_t flags;
856 	int8_t rssi = 0, nf = 0;
857 	int len;
858 
859 	usbd_xfer_status(xfer, &len, NULL, NULL, NULL);
860 
861 	switch (USB_GET_STATE(xfer)) {
862 	case USB_ST_TRANSFERRED:
863 
864 		DPRINTFN(15, "rx done, actlen=%d\n", len);
865 
866 		if (len < (int)(RAL_RX_DESC_SIZE + IEEE80211_MIN_LEN)) {
867 			DPRINTF("%s: xfer too short %d\n",
868 			    device_get_nameunit(sc->sc_dev), len);
869 			counter_u64_add(ic->ic_ierrors, 1);
870 			goto tr_setup;
871 		}
872 
873 		len -= RAL_RX_DESC_SIZE;
874 		/* rx descriptor is located at the end */
875 		pc = usbd_xfer_get_frame(xfer, 0);
876 		usbd_copy_out(pc, len, &sc->sc_rx_desc, RAL_RX_DESC_SIZE);
877 
878 		rssi = URAL_RSSI(sc->sc_rx_desc.rssi);
879 		nf = RAL_NOISE_FLOOR;
880 		flags = le32toh(sc->sc_rx_desc.flags);
881 		if (flags & (RAL_RX_PHY_ERROR | RAL_RX_CRC_ERROR)) {
882 			/*
883 		         * This should not happen since we did not
884 		         * request to receive those frames when we
885 		         * filled RAL_TXRX_CSR2:
886 		         */
887 			DPRINTFN(5, "PHY or CRC error\n");
888 			counter_u64_add(ic->ic_ierrors, 1);
889 			goto tr_setup;
890 		}
891 
892 		m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
893 		if (m == NULL) {
894 			DPRINTF("could not allocate mbuf\n");
895 			counter_u64_add(ic->ic_ierrors, 1);
896 			goto tr_setup;
897 		}
898 		usbd_copy_out(pc, 0, mtod(m, uint8_t *), len);
899 
900 		/* finalize mbuf */
901 		m->m_pkthdr.len = m->m_len = (flags >> 16) & 0xfff;
902 
903 		if (ieee80211_radiotap_active(ic)) {
904 			struct ural_rx_radiotap_header *tap = &sc->sc_rxtap;
905 
906 			/* XXX set once */
907 			tap->wr_flags = 0;
908 			tap->wr_rate = ieee80211_plcp2rate(sc->sc_rx_desc.rate,
909 			    (flags & RAL_RX_OFDM) ?
910 			    IEEE80211_T_OFDM : IEEE80211_T_CCK);
911 			tap->wr_antenna = sc->rx_ant;
912 			tap->wr_antsignal = nf + rssi;
913 			tap->wr_antnoise = nf;
914 		}
915 		/* Strip trailing 802.11 MAC FCS. */
916 		m_adj(m, -IEEE80211_CRC_LEN);
917 
918 		/* FALLTHROUGH */
919 	case USB_ST_SETUP:
920 tr_setup:
921 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
922 		usbd_transfer_submit(xfer);
923 
924 		/*
925 		 * At the end of a USB callback it is always safe to unlock
926 		 * the private mutex of a device! That is why we do the
927 		 * "ieee80211_input" here, and not some lines up!
928 		 */
929 		RAL_UNLOCK(sc);
930 		if (m) {
931 			ni = ieee80211_find_rxnode(ic,
932 			    mtod(m, struct ieee80211_frame_min *));
933 			if (ni != NULL) {
934 				(void) ieee80211_input(ni, m, rssi, nf);
935 				ieee80211_free_node(ni);
936 			} else
937 				(void) ieee80211_input_all(ic, m, rssi, nf);
938 		}
939 		RAL_LOCK(sc);
940 		ural_start(sc);
941 		return;
942 
943 	default:			/* Error */
944 		if (error != USB_ERR_CANCELLED) {
945 			/* try to clear stall first */
946 			usbd_xfer_set_stall(xfer);
947 			goto tr_setup;
948 		}
949 		return;
950 	}
951 }
952 
953 static uint8_t
954 ural_plcp_signal(int rate)
955 {
956 	switch (rate) {
957 	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
958 	case 12:	return 0xb;
959 	case 18:	return 0xf;
960 	case 24:	return 0xa;
961 	case 36:	return 0xe;
962 	case 48:	return 0x9;
963 	case 72:	return 0xd;
964 	case 96:	return 0x8;
965 	case 108:	return 0xc;
966 
967 	/* CCK rates (NB: not IEEE std, device-specific) */
968 	case 2:		return 0x0;
969 	case 4:		return 0x1;
970 	case 11:	return 0x2;
971 	case 22:	return 0x3;
972 	}
973 	return 0xff;		/* XXX unsupported/unknown rate */
974 }
975 
976 static void
977 ural_setup_tx_desc(struct ural_softc *sc, struct ural_tx_desc *desc,
978     uint32_t flags, int len, int rate)
979 {
980 	struct ieee80211com *ic = &sc->sc_ic;
981 	uint16_t plcp_length;
982 	int remainder;
983 
984 	desc->flags = htole32(flags);
985 	desc->flags |= htole32(RAL_TX_NEWSEQ);
986 	desc->flags |= htole32(len << 16);
987 
988 	desc->wme = htole16(RAL_AIFSN(2) | RAL_LOGCWMIN(3) | RAL_LOGCWMAX(5));
989 	desc->wme |= htole16(RAL_IVOFFSET(sizeof (struct ieee80211_frame)));
990 
991 	/* setup PLCP fields */
992 	desc->plcp_signal  = ural_plcp_signal(rate);
993 	desc->plcp_service = 4;
994 
995 	len += IEEE80211_CRC_LEN;
996 	if (ieee80211_rate2phytype(ic->ic_rt, rate) == IEEE80211_T_OFDM) {
997 		desc->flags |= htole32(RAL_TX_OFDM);
998 
999 		plcp_length = len & 0xfff;
1000 		desc->plcp_length_hi = plcp_length >> 6;
1001 		desc->plcp_length_lo = plcp_length & 0x3f;
1002 	} else {
1003 		if (rate == 0)
1004 			rate = 2;	/* avoid division by zero */
1005 		plcp_length = (16 * len + rate - 1) / rate;
1006 		if (rate == 22) {
1007 			remainder = (16 * len) % 22;
1008 			if (remainder != 0 && remainder < 7)
1009 				desc->plcp_service |= RAL_PLCP_LENGEXT;
1010 		}
1011 		desc->plcp_length_hi = plcp_length >> 8;
1012 		desc->plcp_length_lo = plcp_length & 0xff;
1013 
1014 		if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1015 			desc->plcp_signal |= 0x08;
1016 	}
1017 
1018 	desc->iv = 0;
1019 	desc->eiv = 0;
1020 }
1021 
1022 #define RAL_TX_TIMEOUT	5000
1023 
1024 static int
1025 ural_tx_bcn(struct ural_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
1026 {
1027 	struct ieee80211vap *vap = ni->ni_vap;
1028 	struct ieee80211com *ic = ni->ni_ic;
1029 	const struct ieee80211_txparam *tp;
1030 	struct ural_tx_data *data;
1031 
1032 	if (sc->tx_nfree == 0) {
1033 		m_freem(m0);
1034 		ieee80211_free_node(ni);
1035 		return (EIO);
1036 	}
1037 	if (ic->ic_bsschan == IEEE80211_CHAN_ANYC) {
1038 		m_freem(m0);
1039 		ieee80211_free_node(ni);
1040 		return (ENXIO);
1041 	}
1042 	data = STAILQ_FIRST(&sc->tx_free);
1043 	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
1044 	sc->tx_nfree--;
1045 	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_bsschan)];
1046 
1047 	data->m = m0;
1048 	data->ni = ni;
1049 	data->rate = tp->mgmtrate;
1050 
1051 	ural_setup_tx_desc(sc, &data->desc,
1052 	    RAL_TX_IFS_NEWBACKOFF | RAL_TX_TIMESTAMP, m0->m_pkthdr.len,
1053 	    tp->mgmtrate);
1054 
1055 	DPRINTFN(10, "sending beacon frame len=%u rate=%u\n",
1056 	    m0->m_pkthdr.len, tp->mgmtrate);
1057 
1058 	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
1059 	usbd_transfer_start(sc->sc_xfer[URAL_BULK_WR]);
1060 
1061 	return (0);
1062 }
1063 
1064 static int
1065 ural_tx_mgt(struct ural_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
1066 {
1067 	struct ieee80211vap *vap = ni->ni_vap;
1068 	struct ieee80211com *ic = ni->ni_ic;
1069 	const struct ieee80211_txparam *tp;
1070 	struct ural_tx_data *data;
1071 	struct ieee80211_frame *wh;
1072 	struct ieee80211_key *k;
1073 	uint32_t flags;
1074 	uint16_t dur;
1075 
1076 	RAL_LOCK_ASSERT(sc, MA_OWNED);
1077 
1078 	data = STAILQ_FIRST(&sc->tx_free);
1079 	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
1080 	sc->tx_nfree--;
1081 
1082 	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
1083 
1084 	wh = mtod(m0, struct ieee80211_frame *);
1085 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1086 		k = ieee80211_crypto_encap(ni, m0);
1087 		if (k == NULL) {
1088 			m_freem(m0);
1089 			return ENOBUFS;
1090 		}
1091 		wh = mtod(m0, struct ieee80211_frame *);
1092 	}
1093 
1094 	data->m = m0;
1095 	data->ni = ni;
1096 	data->rate = tp->mgmtrate;
1097 
1098 	flags = 0;
1099 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1100 		flags |= RAL_TX_ACK;
1101 
1102 		dur = ieee80211_ack_duration(ic->ic_rt, tp->mgmtrate,
1103 		    ic->ic_flags & IEEE80211_F_SHPREAMBLE);
1104 		USETW(wh->i_dur, dur);
1105 
1106 		/* tell hardware to add timestamp for probe responses */
1107 		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1108 		    IEEE80211_FC0_TYPE_MGT &&
1109 		    (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
1110 		    IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1111 			flags |= RAL_TX_TIMESTAMP;
1112 	}
1113 
1114 	ural_setup_tx_desc(sc, &data->desc, flags, m0->m_pkthdr.len, tp->mgmtrate);
1115 
1116 	DPRINTFN(10, "sending mgt frame len=%u rate=%u\n",
1117 	    m0->m_pkthdr.len, tp->mgmtrate);
1118 
1119 	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
1120 	usbd_transfer_start(sc->sc_xfer[URAL_BULK_WR]);
1121 
1122 	return 0;
1123 }
1124 
1125 static int
1126 ural_sendprot(struct ural_softc *sc,
1127     const struct mbuf *m, struct ieee80211_node *ni, int prot, int rate)
1128 {
1129 	struct ieee80211com *ic = ni->ni_ic;
1130 	const struct ieee80211_frame *wh;
1131 	struct ural_tx_data *data;
1132 	struct mbuf *mprot;
1133 	int protrate, ackrate, pktlen, flags, isshort;
1134 	uint16_t dur;
1135 
1136 	KASSERT(prot == IEEE80211_PROT_RTSCTS || prot == IEEE80211_PROT_CTSONLY,
1137 	    ("protection %d", prot));
1138 
1139 	wh = mtod(m, const struct ieee80211_frame *);
1140 	pktlen = m->m_pkthdr.len + IEEE80211_CRC_LEN;
1141 
1142 	protrate = ieee80211_ctl_rate(ic->ic_rt, rate);
1143 	ackrate = ieee80211_ack_rate(ic->ic_rt, rate);
1144 
1145 	isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
1146 	dur = ieee80211_compute_duration(ic->ic_rt, pktlen, rate, isshort)
1147 	    + ieee80211_ack_duration(ic->ic_rt, rate, isshort);
1148 	flags = RAL_TX_RETRY(7);
1149 	if (prot == IEEE80211_PROT_RTSCTS) {
1150 		/* NB: CTS is the same size as an ACK */
1151 		dur += ieee80211_ack_duration(ic->ic_rt, rate, isshort);
1152 		flags |= RAL_TX_ACK;
1153 		mprot = ieee80211_alloc_rts(ic, wh->i_addr1, wh->i_addr2, dur);
1154 	} else {
1155 		mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr, dur);
1156 	}
1157 	if (mprot == NULL) {
1158 		/* XXX stat + msg */
1159 		return ENOBUFS;
1160 	}
1161 	data = STAILQ_FIRST(&sc->tx_free);
1162 	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
1163 	sc->tx_nfree--;
1164 
1165 	data->m = mprot;
1166 	data->ni = ieee80211_ref_node(ni);
1167 	data->rate = protrate;
1168 	ural_setup_tx_desc(sc, &data->desc, flags, mprot->m_pkthdr.len, protrate);
1169 
1170 	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
1171 	usbd_transfer_start(sc->sc_xfer[URAL_BULK_WR]);
1172 
1173 	return 0;
1174 }
1175 
1176 static int
1177 ural_tx_raw(struct ural_softc *sc, struct mbuf *m0, struct ieee80211_node *ni,
1178     const struct ieee80211_bpf_params *params)
1179 {
1180 	struct ieee80211com *ic = ni->ni_ic;
1181 	struct ural_tx_data *data;
1182 	uint32_t flags;
1183 	int error;
1184 	int rate;
1185 
1186 	RAL_LOCK_ASSERT(sc, MA_OWNED);
1187 	KASSERT(params != NULL, ("no raw xmit params"));
1188 
1189 	rate = params->ibp_rate0;
1190 	if (!ieee80211_isratevalid(ic->ic_rt, rate)) {
1191 		m_freem(m0);
1192 		return EINVAL;
1193 	}
1194 	flags = 0;
1195 	if ((params->ibp_flags & IEEE80211_BPF_NOACK) == 0)
1196 		flags |= RAL_TX_ACK;
1197 	if (params->ibp_flags & (IEEE80211_BPF_RTS|IEEE80211_BPF_CTS)) {
1198 		error = ural_sendprot(sc, m0, ni,
1199 		    params->ibp_flags & IEEE80211_BPF_RTS ?
1200 			 IEEE80211_PROT_RTSCTS : IEEE80211_PROT_CTSONLY,
1201 		    rate);
1202 		if (error || sc->tx_nfree == 0) {
1203 			m_freem(m0);
1204 			return ENOBUFS;
1205 		}
1206 		flags |= RAL_TX_IFS_SIFS;
1207 	}
1208 
1209 	data = STAILQ_FIRST(&sc->tx_free);
1210 	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
1211 	sc->tx_nfree--;
1212 
1213 	data->m = m0;
1214 	data->ni = ni;
1215 	data->rate = rate;
1216 
1217 	/* XXX need to setup descriptor ourself */
1218 	ural_setup_tx_desc(sc, &data->desc, flags, m0->m_pkthdr.len, rate);
1219 
1220 	DPRINTFN(10, "sending raw frame len=%u rate=%u\n",
1221 	    m0->m_pkthdr.len, rate);
1222 
1223 	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
1224 	usbd_transfer_start(sc->sc_xfer[URAL_BULK_WR]);
1225 
1226 	return 0;
1227 }
1228 
1229 static int
1230 ural_tx_data(struct ural_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
1231 {
1232 	struct ieee80211vap *vap = ni->ni_vap;
1233 	struct ieee80211com *ic = ni->ni_ic;
1234 	struct ural_tx_data *data;
1235 	struct ieee80211_frame *wh;
1236 	const struct ieee80211_txparam *tp;
1237 	struct ieee80211_key *k;
1238 	uint32_t flags = 0;
1239 	uint16_t dur;
1240 	int error, rate;
1241 
1242 	RAL_LOCK_ASSERT(sc, MA_OWNED);
1243 
1244 	wh = mtod(m0, struct ieee80211_frame *);
1245 
1246 	tp = &vap->iv_txparms[ieee80211_chan2mode(ni->ni_chan)];
1247 	if (IEEE80211_IS_MULTICAST(wh->i_addr1))
1248 		rate = tp->mcastrate;
1249 	else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
1250 		rate = tp->ucastrate;
1251 	else
1252 		rate = ni->ni_txrate;
1253 
1254 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1255 		k = ieee80211_crypto_encap(ni, m0);
1256 		if (k == NULL) {
1257 			m_freem(m0);
1258 			return ENOBUFS;
1259 		}
1260 		/* packet header may have moved, reset our local pointer */
1261 		wh = mtod(m0, struct ieee80211_frame *);
1262 	}
1263 
1264 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1265 		int prot = IEEE80211_PROT_NONE;
1266 		if (m0->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
1267 			prot = IEEE80211_PROT_RTSCTS;
1268 		else if ((ic->ic_flags & IEEE80211_F_USEPROT) &&
1269 		    ieee80211_rate2phytype(ic->ic_rt, rate) == IEEE80211_T_OFDM)
1270 			prot = ic->ic_protmode;
1271 		if (prot != IEEE80211_PROT_NONE) {
1272 			error = ural_sendprot(sc, m0, ni, prot, rate);
1273 			if (error || sc->tx_nfree == 0) {
1274 				m_freem(m0);
1275 				return ENOBUFS;
1276 			}
1277 			flags |= RAL_TX_IFS_SIFS;
1278 		}
1279 	}
1280 
1281 	data = STAILQ_FIRST(&sc->tx_free);
1282 	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
1283 	sc->tx_nfree--;
1284 
1285 	data->m = m0;
1286 	data->ni = ni;
1287 	data->rate = rate;
1288 
1289 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1290 		flags |= RAL_TX_ACK;
1291 		flags |= RAL_TX_RETRY(7);
1292 
1293 		dur = ieee80211_ack_duration(ic->ic_rt, rate,
1294 		    ic->ic_flags & IEEE80211_F_SHPREAMBLE);
1295 		USETW(wh->i_dur, dur);
1296 	}
1297 
1298 	ural_setup_tx_desc(sc, &data->desc, flags, m0->m_pkthdr.len, rate);
1299 
1300 	DPRINTFN(10, "sending data frame len=%u rate=%u\n",
1301 	    m0->m_pkthdr.len, rate);
1302 
1303 	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
1304 	usbd_transfer_start(sc->sc_xfer[URAL_BULK_WR]);
1305 
1306 	return 0;
1307 }
1308 
1309 static int
1310 ural_transmit(struct ieee80211com *ic, struct mbuf *m)
1311 {
1312 	struct ural_softc *sc = ic->ic_softc;
1313 	int error;
1314 
1315 	RAL_LOCK(sc);
1316 	if (!sc->sc_running) {
1317 		RAL_UNLOCK(sc);
1318 		return (ENXIO);
1319 	}
1320 	error = mbufq_enqueue(&sc->sc_snd, m);
1321 	if (error) {
1322 		RAL_UNLOCK(sc);
1323 		return (error);
1324 	}
1325 	ural_start(sc);
1326 	RAL_UNLOCK(sc);
1327 
1328 	return (0);
1329 }
1330 
1331 static void
1332 ural_start(struct ural_softc *sc)
1333 {
1334 	struct ieee80211_node *ni;
1335 	struct mbuf *m;
1336 
1337 	RAL_LOCK_ASSERT(sc, MA_OWNED);
1338 
1339 	if (sc->sc_running == 0)
1340 		return;
1341 
1342 	while (sc->tx_nfree >= RAL_TX_MINFREE &&
1343 	    (m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
1344 		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
1345 		if (ural_tx_data(sc, m, ni) != 0) {
1346 			if_inc_counter(ni->ni_vap->iv_ifp,
1347 			     IFCOUNTER_OERRORS, 1);
1348 			ieee80211_free_node(ni);
1349 			break;
1350 		}
1351 	}
1352 }
1353 
1354 static void
1355 ural_parent(struct ieee80211com *ic)
1356 {
1357 	struct ural_softc *sc = ic->ic_softc;
1358 	int startall = 0;
1359 
1360 	RAL_LOCK(sc);
1361 	if (sc->sc_detached) {
1362 		RAL_UNLOCK(sc);
1363 		return;
1364 	}
1365 	if (ic->ic_nrunning > 0) {
1366 		if (sc->sc_running == 0) {
1367 			ural_init(sc);
1368 			startall = 1;
1369 		} else
1370 			ural_setpromisc(sc);
1371 	} else if (sc->sc_running)
1372 		ural_stop(sc);
1373 	RAL_UNLOCK(sc);
1374 	if (startall)
1375 		ieee80211_start_all(ic);
1376 }
1377 
1378 static void
1379 ural_set_testmode(struct ural_softc *sc)
1380 {
1381 	struct usb_device_request req;
1382 	usb_error_t error;
1383 
1384 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1385 	req.bRequest = RAL_VENDOR_REQUEST;
1386 	USETW(req.wValue, 4);
1387 	USETW(req.wIndex, 1);
1388 	USETW(req.wLength, 0);
1389 
1390 	error = ural_do_request(sc, &req, NULL);
1391 	if (error != 0) {
1392 		device_printf(sc->sc_dev, "could not set test mode: %s\n",
1393 		    usbd_errstr(error));
1394 	}
1395 }
1396 
1397 static void
1398 ural_eeprom_read(struct ural_softc *sc, uint16_t addr, void *buf, int len)
1399 {
1400 	struct usb_device_request req;
1401 	usb_error_t error;
1402 
1403 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1404 	req.bRequest = RAL_READ_EEPROM;
1405 	USETW(req.wValue, 0);
1406 	USETW(req.wIndex, addr);
1407 	USETW(req.wLength, len);
1408 
1409 	error = ural_do_request(sc, &req, buf);
1410 	if (error != 0) {
1411 		device_printf(sc->sc_dev, "could not read EEPROM: %s\n",
1412 		    usbd_errstr(error));
1413 	}
1414 }
1415 
1416 static uint16_t
1417 ural_read(struct ural_softc *sc, uint16_t reg)
1418 {
1419 	struct usb_device_request req;
1420 	usb_error_t error;
1421 	uint16_t val;
1422 
1423 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1424 	req.bRequest = RAL_READ_MAC;
1425 	USETW(req.wValue, 0);
1426 	USETW(req.wIndex, reg);
1427 	USETW(req.wLength, sizeof (uint16_t));
1428 
1429 	error = ural_do_request(sc, &req, &val);
1430 	if (error != 0) {
1431 		device_printf(sc->sc_dev, "could not read MAC register: %s\n",
1432 		    usbd_errstr(error));
1433 		return 0;
1434 	}
1435 
1436 	return le16toh(val);
1437 }
1438 
1439 static void
1440 ural_read_multi(struct ural_softc *sc, uint16_t reg, void *buf, int len)
1441 {
1442 	struct usb_device_request req;
1443 	usb_error_t error;
1444 
1445 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1446 	req.bRequest = RAL_READ_MULTI_MAC;
1447 	USETW(req.wValue, 0);
1448 	USETW(req.wIndex, reg);
1449 	USETW(req.wLength, len);
1450 
1451 	error = ural_do_request(sc, &req, buf);
1452 	if (error != 0) {
1453 		device_printf(sc->sc_dev, "could not read MAC register: %s\n",
1454 		    usbd_errstr(error));
1455 	}
1456 }
1457 
1458 static void
1459 ural_write(struct ural_softc *sc, uint16_t reg, uint16_t val)
1460 {
1461 	struct usb_device_request req;
1462 	usb_error_t error;
1463 
1464 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1465 	req.bRequest = RAL_WRITE_MAC;
1466 	USETW(req.wValue, val);
1467 	USETW(req.wIndex, reg);
1468 	USETW(req.wLength, 0);
1469 
1470 	error = ural_do_request(sc, &req, NULL);
1471 	if (error != 0) {
1472 		device_printf(sc->sc_dev, "could not write MAC register: %s\n",
1473 		    usbd_errstr(error));
1474 	}
1475 }
1476 
1477 static void
1478 ural_write_multi(struct ural_softc *sc, uint16_t reg, void *buf, int len)
1479 {
1480 	struct usb_device_request req;
1481 	usb_error_t error;
1482 
1483 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1484 	req.bRequest = RAL_WRITE_MULTI_MAC;
1485 	USETW(req.wValue, 0);
1486 	USETW(req.wIndex, reg);
1487 	USETW(req.wLength, len);
1488 
1489 	error = ural_do_request(sc, &req, buf);
1490 	if (error != 0) {
1491 		device_printf(sc->sc_dev, "could not write MAC register: %s\n",
1492 		    usbd_errstr(error));
1493 	}
1494 }
1495 
1496 static void
1497 ural_bbp_write(struct ural_softc *sc, uint8_t reg, uint8_t val)
1498 {
1499 	uint16_t tmp;
1500 	int ntries;
1501 
1502 	for (ntries = 0; ntries < 100; ntries++) {
1503 		if (!(ural_read(sc, RAL_PHY_CSR8) & RAL_BBP_BUSY))
1504 			break;
1505 		if (ural_pause(sc, hz / 100))
1506 			break;
1507 	}
1508 	if (ntries == 100) {
1509 		device_printf(sc->sc_dev, "could not write to BBP\n");
1510 		return;
1511 	}
1512 
1513 	tmp = reg << 8 | val;
1514 	ural_write(sc, RAL_PHY_CSR7, tmp);
1515 }
1516 
1517 static uint8_t
1518 ural_bbp_read(struct ural_softc *sc, uint8_t reg)
1519 {
1520 	uint16_t val;
1521 	int ntries;
1522 
1523 	val = RAL_BBP_WRITE | reg << 8;
1524 	ural_write(sc, RAL_PHY_CSR7, val);
1525 
1526 	for (ntries = 0; ntries < 100; ntries++) {
1527 		if (!(ural_read(sc, RAL_PHY_CSR8) & RAL_BBP_BUSY))
1528 			break;
1529 		if (ural_pause(sc, hz / 100))
1530 			break;
1531 	}
1532 	if (ntries == 100) {
1533 		device_printf(sc->sc_dev, "could not read BBP\n");
1534 		return 0;
1535 	}
1536 
1537 	return ural_read(sc, RAL_PHY_CSR7) & 0xff;
1538 }
1539 
1540 static void
1541 ural_rf_write(struct ural_softc *sc, uint8_t reg, uint32_t val)
1542 {
1543 	uint32_t tmp;
1544 	int ntries;
1545 
1546 	for (ntries = 0; ntries < 100; ntries++) {
1547 		if (!(ural_read(sc, RAL_PHY_CSR10) & RAL_RF_LOBUSY))
1548 			break;
1549 		if (ural_pause(sc, hz / 100))
1550 			break;
1551 	}
1552 	if (ntries == 100) {
1553 		device_printf(sc->sc_dev, "could not write to RF\n");
1554 		return;
1555 	}
1556 
1557 	tmp = RAL_RF_BUSY | RAL_RF_20BIT | (val & 0xfffff) << 2 | (reg & 0x3);
1558 	ural_write(sc, RAL_PHY_CSR9,  tmp & 0xffff);
1559 	ural_write(sc, RAL_PHY_CSR10, tmp >> 16);
1560 
1561 	/* remember last written value in sc */
1562 	sc->rf_regs[reg] = val;
1563 
1564 	DPRINTFN(15, "RF R[%u] <- 0x%05x\n", reg & 0x3, val & 0xfffff);
1565 }
1566 
1567 static void
1568 ural_scan_start(struct ieee80211com *ic)
1569 {
1570 	struct ural_softc *sc = ic->ic_softc;
1571 
1572 	RAL_LOCK(sc);
1573 	ural_write(sc, RAL_TXRX_CSR19, 0);
1574 	ural_set_bssid(sc, ieee80211broadcastaddr);
1575 	RAL_UNLOCK(sc);
1576 }
1577 
1578 static void
1579 ural_scan_end(struct ieee80211com *ic)
1580 {
1581 	struct ural_softc *sc = ic->ic_softc;
1582 
1583 	RAL_LOCK(sc);
1584 	ural_enable_tsf_sync(sc);
1585 	ural_set_bssid(sc, sc->sc_bssid);
1586 	RAL_UNLOCK(sc);
1587 
1588 }
1589 
1590 static void
1591 ural_set_channel(struct ieee80211com *ic)
1592 {
1593 	struct ural_softc *sc = ic->ic_softc;
1594 
1595 	RAL_LOCK(sc);
1596 	ural_set_chan(sc, ic->ic_curchan);
1597 	RAL_UNLOCK(sc);
1598 }
1599 
1600 static void
1601 ural_set_chan(struct ural_softc *sc, struct ieee80211_channel *c)
1602 {
1603 	struct ieee80211com *ic = &sc->sc_ic;
1604 	uint8_t power, tmp;
1605 	int i, chan;
1606 
1607 	chan = ieee80211_chan2ieee(ic, c);
1608 	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
1609 		return;
1610 
1611 	if (IEEE80211_IS_CHAN_2GHZ(c))
1612 		power = min(sc->txpow[chan - 1], 31);
1613 	else
1614 		power = 31;
1615 
1616 	/* adjust txpower using ifconfig settings */
1617 	power -= (100 - ic->ic_txpowlimit) / 8;
1618 
1619 	DPRINTFN(2, "setting channel to %u, txpower to %u\n", chan, power);
1620 
1621 	switch (sc->rf_rev) {
1622 	case RAL_RF_2522:
1623 		ural_rf_write(sc, RAL_RF1, 0x00814);
1624 		ural_rf_write(sc, RAL_RF2, ural_rf2522_r2[chan - 1]);
1625 		ural_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
1626 		break;
1627 
1628 	case RAL_RF_2523:
1629 		ural_rf_write(sc, RAL_RF1, 0x08804);
1630 		ural_rf_write(sc, RAL_RF2, ural_rf2523_r2[chan - 1]);
1631 		ural_rf_write(sc, RAL_RF3, power << 7 | 0x38044);
1632 		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1633 		break;
1634 
1635 	case RAL_RF_2524:
1636 		ural_rf_write(sc, RAL_RF1, 0x0c808);
1637 		ural_rf_write(sc, RAL_RF2, ural_rf2524_r2[chan - 1]);
1638 		ural_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
1639 		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1640 		break;
1641 
1642 	case RAL_RF_2525:
1643 		ural_rf_write(sc, RAL_RF1, 0x08808);
1644 		ural_rf_write(sc, RAL_RF2, ural_rf2525_hi_r2[chan - 1]);
1645 		ural_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
1646 		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1647 
1648 		ural_rf_write(sc, RAL_RF1, 0x08808);
1649 		ural_rf_write(sc, RAL_RF2, ural_rf2525_r2[chan - 1]);
1650 		ural_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
1651 		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1652 		break;
1653 
1654 	case RAL_RF_2525E:
1655 		ural_rf_write(sc, RAL_RF1, 0x08808);
1656 		ural_rf_write(sc, RAL_RF2, ural_rf2525e_r2[chan - 1]);
1657 		ural_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
1658 		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00286 : 0x00282);
1659 		break;
1660 
1661 	case RAL_RF_2526:
1662 		ural_rf_write(sc, RAL_RF2, ural_rf2526_hi_r2[chan - 1]);
1663 		ural_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
1664 		ural_rf_write(sc, RAL_RF1, 0x08804);
1665 
1666 		ural_rf_write(sc, RAL_RF2, ural_rf2526_r2[chan - 1]);
1667 		ural_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
1668 		ural_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
1669 		break;
1670 
1671 	/* dual-band RF */
1672 	case RAL_RF_5222:
1673 		for (i = 0; ural_rf5222[i].chan != chan; i++);
1674 
1675 		ural_rf_write(sc, RAL_RF1, ural_rf5222[i].r1);
1676 		ural_rf_write(sc, RAL_RF2, ural_rf5222[i].r2);
1677 		ural_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
1678 		ural_rf_write(sc, RAL_RF4, ural_rf5222[i].r4);
1679 		break;
1680 	}
1681 
1682 	if (ic->ic_opmode != IEEE80211_M_MONITOR &&
1683 	    (ic->ic_flags & IEEE80211_F_SCAN) == 0) {
1684 		/* set Japan filter bit for channel 14 */
1685 		tmp = ural_bbp_read(sc, 70);
1686 
1687 		tmp &= ~RAL_JAPAN_FILTER;
1688 		if (chan == 14)
1689 			tmp |= RAL_JAPAN_FILTER;
1690 
1691 		ural_bbp_write(sc, 70, tmp);
1692 
1693 		/* clear CRC errors */
1694 		ural_read(sc, RAL_STA_CSR0);
1695 
1696 		ural_pause(sc, hz / 100);
1697 		ural_disable_rf_tune(sc);
1698 	}
1699 
1700 	/* XXX doesn't belong here */
1701 	/* update basic rate set */
1702 	ural_set_basicrates(sc, c);
1703 
1704 	/* give the hardware some time to do the switchover */
1705 	ural_pause(sc, hz / 100);
1706 }
1707 
1708 /*
1709  * Disable RF auto-tuning.
1710  */
1711 static void
1712 ural_disable_rf_tune(struct ural_softc *sc)
1713 {
1714 	uint32_t tmp;
1715 
1716 	if (sc->rf_rev != RAL_RF_2523) {
1717 		tmp = sc->rf_regs[RAL_RF1] & ~RAL_RF1_AUTOTUNE;
1718 		ural_rf_write(sc, RAL_RF1, tmp);
1719 	}
1720 
1721 	tmp = sc->rf_regs[RAL_RF3] & ~RAL_RF3_AUTOTUNE;
1722 	ural_rf_write(sc, RAL_RF3, tmp);
1723 
1724 	DPRINTFN(2, "disabling RF autotune\n");
1725 }
1726 
1727 /*
1728  * Refer to IEEE Std 802.11-1999 pp. 123 for more information on TSF
1729  * synchronization.
1730  */
1731 static void
1732 ural_enable_tsf_sync(struct ural_softc *sc)
1733 {
1734 	struct ieee80211com *ic = &sc->sc_ic;
1735 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1736 	uint16_t logcwmin, preload, tmp;
1737 
1738 	/* first, disable TSF synchronization */
1739 	ural_write(sc, RAL_TXRX_CSR19, 0);
1740 
1741 	tmp = (16 * vap->iv_bss->ni_intval) << 4;
1742 	ural_write(sc, RAL_TXRX_CSR18, tmp);
1743 
1744 	logcwmin = (ic->ic_opmode == IEEE80211_M_IBSS) ? 2 : 0;
1745 	preload = (ic->ic_opmode == IEEE80211_M_IBSS) ? 320 : 6;
1746 	tmp = logcwmin << 12 | preload;
1747 	ural_write(sc, RAL_TXRX_CSR20, tmp);
1748 
1749 	/* finally, enable TSF synchronization */
1750 	tmp = RAL_ENABLE_TSF | RAL_ENABLE_TBCN;
1751 	if (ic->ic_opmode == IEEE80211_M_STA)
1752 		tmp |= RAL_ENABLE_TSF_SYNC(1);
1753 	else
1754 		tmp |= RAL_ENABLE_TSF_SYNC(2) | RAL_ENABLE_BEACON_GENERATOR;
1755 	ural_write(sc, RAL_TXRX_CSR19, tmp);
1756 
1757 	DPRINTF("enabling TSF synchronization\n");
1758 }
1759 
1760 static void
1761 ural_enable_tsf(struct ural_softc *sc)
1762 {
1763 	/* first, disable TSF synchronization */
1764 	ural_write(sc, RAL_TXRX_CSR19, 0);
1765 	ural_write(sc, RAL_TXRX_CSR19, RAL_ENABLE_TSF | RAL_ENABLE_TSF_SYNC(2));
1766 }
1767 
1768 #define RAL_RXTX_TURNAROUND	5	/* us */
1769 static void
1770 ural_update_slot(struct ural_softc *sc)
1771 {
1772 	struct ieee80211com *ic = &sc->sc_ic;
1773 	uint16_t slottime, sifs, eifs;
1774 
1775 	slottime = IEEE80211_GET_SLOTTIME(ic);
1776 
1777 	/*
1778 	 * These settings may sound a bit inconsistent but this is what the
1779 	 * reference driver does.
1780 	 */
1781 	if (ic->ic_curmode == IEEE80211_MODE_11B) {
1782 		sifs = 16 - RAL_RXTX_TURNAROUND;
1783 		eifs = 364;
1784 	} else {
1785 		sifs = 10 - RAL_RXTX_TURNAROUND;
1786 		eifs = 64;
1787 	}
1788 
1789 	ural_write(sc, RAL_MAC_CSR10, slottime);
1790 	ural_write(sc, RAL_MAC_CSR11, sifs);
1791 	ural_write(sc, RAL_MAC_CSR12, eifs);
1792 }
1793 
1794 static void
1795 ural_set_txpreamble(struct ural_softc *sc)
1796 {
1797 	struct ieee80211com *ic = &sc->sc_ic;
1798 	uint16_t tmp;
1799 
1800 	tmp = ural_read(sc, RAL_TXRX_CSR10);
1801 
1802 	tmp &= ~RAL_SHORT_PREAMBLE;
1803 	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
1804 		tmp |= RAL_SHORT_PREAMBLE;
1805 
1806 	ural_write(sc, RAL_TXRX_CSR10, tmp);
1807 }
1808 
1809 static void
1810 ural_set_basicrates(struct ural_softc *sc, const struct ieee80211_channel *c)
1811 {
1812 	/* XXX wrong, take from rate set */
1813 	/* update basic rate set */
1814 	if (IEEE80211_IS_CHAN_5GHZ(c)) {
1815 		/* 11a basic rates: 6, 12, 24Mbps */
1816 		ural_write(sc, RAL_TXRX_CSR11, 0x150);
1817 	} else if (IEEE80211_IS_CHAN_ANYG(c)) {
1818 		/* 11g basic rates: 1, 2, 5.5, 11, 6, 12, 24Mbps */
1819 		ural_write(sc, RAL_TXRX_CSR11, 0x15f);
1820 	} else {
1821 		/* 11b basic rates: 1, 2Mbps */
1822 		ural_write(sc, RAL_TXRX_CSR11, 0x3);
1823 	}
1824 }
1825 
1826 static void
1827 ural_set_bssid(struct ural_softc *sc, const uint8_t *bssid)
1828 {
1829 	uint16_t tmp;
1830 
1831 	tmp = bssid[0] | bssid[1] << 8;
1832 	ural_write(sc, RAL_MAC_CSR5, tmp);
1833 
1834 	tmp = bssid[2] | bssid[3] << 8;
1835 	ural_write(sc, RAL_MAC_CSR6, tmp);
1836 
1837 	tmp = bssid[4] | bssid[5] << 8;
1838 	ural_write(sc, RAL_MAC_CSR7, tmp);
1839 
1840 	DPRINTF("setting BSSID to %6D\n", bssid, ":");
1841 }
1842 
1843 static void
1844 ural_set_macaddr(struct ural_softc *sc, const uint8_t *addr)
1845 {
1846 	uint16_t tmp;
1847 
1848 	tmp = addr[0] | addr[1] << 8;
1849 	ural_write(sc, RAL_MAC_CSR2, tmp);
1850 
1851 	tmp = addr[2] | addr[3] << 8;
1852 	ural_write(sc, RAL_MAC_CSR3, tmp);
1853 
1854 	tmp = addr[4] | addr[5] << 8;
1855 	ural_write(sc, RAL_MAC_CSR4, tmp);
1856 
1857 	DPRINTF("setting MAC address to %6D\n", addr, ":");
1858 }
1859 
1860 static void
1861 ural_setpromisc(struct ural_softc *sc)
1862 {
1863 	uint32_t tmp;
1864 
1865 	tmp = ural_read(sc, RAL_TXRX_CSR2);
1866 
1867 	tmp &= ~RAL_DROP_NOT_TO_ME;
1868 	if (sc->sc_ic.ic_promisc == 0)
1869 		tmp |= RAL_DROP_NOT_TO_ME;
1870 
1871 	ural_write(sc, RAL_TXRX_CSR2, tmp);
1872 
1873 	DPRINTF("%s promiscuous mode\n", sc->sc_ic.ic_promisc ?
1874 	    "entering" : "leaving");
1875 }
1876 
1877 static void
1878 ural_update_promisc(struct ieee80211com *ic)
1879 {
1880 	struct ural_softc *sc = ic->ic_softc;
1881 
1882 	RAL_LOCK(sc);
1883 	if (sc->sc_running)
1884 		ural_setpromisc(sc);
1885 	RAL_UNLOCK(sc);
1886 }
1887 
1888 static const char *
1889 ural_get_rf(int rev)
1890 {
1891 	switch (rev) {
1892 	case RAL_RF_2522:	return "RT2522";
1893 	case RAL_RF_2523:	return "RT2523";
1894 	case RAL_RF_2524:	return "RT2524";
1895 	case RAL_RF_2525:	return "RT2525";
1896 	case RAL_RF_2525E:	return "RT2525e";
1897 	case RAL_RF_2526:	return "RT2526";
1898 	case RAL_RF_5222:	return "RT5222";
1899 	default:		return "unknown";
1900 	}
1901 }
1902 
1903 static void
1904 ural_read_eeprom(struct ural_softc *sc)
1905 {
1906 	struct ieee80211com *ic = &sc->sc_ic;
1907 	uint16_t val;
1908 
1909 	ural_eeprom_read(sc, RAL_EEPROM_CONFIG0, &val, 2);
1910 	val = le16toh(val);
1911 	sc->rf_rev =   (val >> 11) & 0x7;
1912 	sc->hw_radio = (val >> 10) & 0x1;
1913 	sc->led_mode = (val >> 6)  & 0x7;
1914 	sc->rx_ant =   (val >> 4)  & 0x3;
1915 	sc->tx_ant =   (val >> 2)  & 0x3;
1916 	sc->nb_ant =   val & 0x3;
1917 
1918 	/* read MAC address */
1919 	ural_eeprom_read(sc, RAL_EEPROM_ADDRESS, ic->ic_macaddr, 6);
1920 
1921 	/* read default values for BBP registers */
1922 	ural_eeprom_read(sc, RAL_EEPROM_BBP_BASE, sc->bbp_prom, 2 * 16);
1923 
1924 	/* read Tx power for all b/g channels */
1925 	ural_eeprom_read(sc, RAL_EEPROM_TXPOWER, sc->txpow, 14);
1926 }
1927 
1928 static int
1929 ural_bbp_init(struct ural_softc *sc)
1930 {
1931 	int i, ntries;
1932 
1933 	/* wait for BBP to be ready */
1934 	for (ntries = 0; ntries < 100; ntries++) {
1935 		if (ural_bbp_read(sc, RAL_BBP_VERSION) != 0)
1936 			break;
1937 		if (ural_pause(sc, hz / 100))
1938 			break;
1939 	}
1940 	if (ntries == 100) {
1941 		device_printf(sc->sc_dev, "timeout waiting for BBP\n");
1942 		return EIO;
1943 	}
1944 
1945 	/* initialize BBP registers to default values */
1946 	for (i = 0; i < nitems(ural_def_bbp); i++)
1947 		ural_bbp_write(sc, ural_def_bbp[i].reg, ural_def_bbp[i].val);
1948 
1949 #if 0
1950 	/* initialize BBP registers to values stored in EEPROM */
1951 	for (i = 0; i < 16; i++) {
1952 		if (sc->bbp_prom[i].reg == 0xff)
1953 			continue;
1954 		ural_bbp_write(sc, sc->bbp_prom[i].reg, sc->bbp_prom[i].val);
1955 	}
1956 #endif
1957 
1958 	return 0;
1959 }
1960 
1961 static void
1962 ural_set_txantenna(struct ural_softc *sc, int antenna)
1963 {
1964 	uint16_t tmp;
1965 	uint8_t tx;
1966 
1967 	tx = ural_bbp_read(sc, RAL_BBP_TX) & ~RAL_BBP_ANTMASK;
1968 	if (antenna == 1)
1969 		tx |= RAL_BBP_ANTA;
1970 	else if (antenna == 2)
1971 		tx |= RAL_BBP_ANTB;
1972 	else
1973 		tx |= RAL_BBP_DIVERSITY;
1974 
1975 	/* need to force I/Q flip for RF 2525e, 2526 and 5222 */
1976 	if (sc->rf_rev == RAL_RF_2525E || sc->rf_rev == RAL_RF_2526 ||
1977 	    sc->rf_rev == RAL_RF_5222)
1978 		tx |= RAL_BBP_FLIPIQ;
1979 
1980 	ural_bbp_write(sc, RAL_BBP_TX, tx);
1981 
1982 	/* update values in PHY_CSR5 and PHY_CSR6 */
1983 	tmp = ural_read(sc, RAL_PHY_CSR5) & ~0x7;
1984 	ural_write(sc, RAL_PHY_CSR5, tmp | (tx & 0x7));
1985 
1986 	tmp = ural_read(sc, RAL_PHY_CSR6) & ~0x7;
1987 	ural_write(sc, RAL_PHY_CSR6, tmp | (tx & 0x7));
1988 }
1989 
1990 static void
1991 ural_set_rxantenna(struct ural_softc *sc, int antenna)
1992 {
1993 	uint8_t rx;
1994 
1995 	rx = ural_bbp_read(sc, RAL_BBP_RX) & ~RAL_BBP_ANTMASK;
1996 	if (antenna == 1)
1997 		rx |= RAL_BBP_ANTA;
1998 	else if (antenna == 2)
1999 		rx |= RAL_BBP_ANTB;
2000 	else
2001 		rx |= RAL_BBP_DIVERSITY;
2002 
2003 	/* need to force no I/Q flip for RF 2525e and 2526 */
2004 	if (sc->rf_rev == RAL_RF_2525E || sc->rf_rev == RAL_RF_2526)
2005 		rx &= ~RAL_BBP_FLIPIQ;
2006 
2007 	ural_bbp_write(sc, RAL_BBP_RX, rx);
2008 }
2009 
2010 static void
2011 ural_init(struct ural_softc *sc)
2012 {
2013 	struct ieee80211com *ic = &sc->sc_ic;
2014 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
2015 	uint16_t tmp;
2016 	int i, ntries;
2017 
2018 	RAL_LOCK_ASSERT(sc, MA_OWNED);
2019 
2020 	ural_set_testmode(sc);
2021 	ural_write(sc, 0x308, 0x00f0);	/* XXX magic */
2022 
2023 	ural_stop(sc);
2024 
2025 	/* initialize MAC registers to default values */
2026 	for (i = 0; i < nitems(ural_def_mac); i++)
2027 		ural_write(sc, ural_def_mac[i].reg, ural_def_mac[i].val);
2028 
2029 	/* wait for BBP and RF to wake up (this can take a long time!) */
2030 	for (ntries = 0; ntries < 100; ntries++) {
2031 		tmp = ural_read(sc, RAL_MAC_CSR17);
2032 		if ((tmp & (RAL_BBP_AWAKE | RAL_RF_AWAKE)) ==
2033 		    (RAL_BBP_AWAKE | RAL_RF_AWAKE))
2034 			break;
2035 		if (ural_pause(sc, hz / 100))
2036 			break;
2037 	}
2038 	if (ntries == 100) {
2039 		device_printf(sc->sc_dev,
2040 		    "timeout waiting for BBP/RF to wakeup\n");
2041 		goto fail;
2042 	}
2043 
2044 	/* we're ready! */
2045 	ural_write(sc, RAL_MAC_CSR1, RAL_HOST_READY);
2046 
2047 	/* set basic rate set (will be updated later) */
2048 	ural_write(sc, RAL_TXRX_CSR11, 0x15f);
2049 
2050 	if (ural_bbp_init(sc) != 0)
2051 		goto fail;
2052 
2053 	ural_set_chan(sc, ic->ic_curchan);
2054 
2055 	/* clear statistic registers (STA_CSR0 to STA_CSR10) */
2056 	ural_read_multi(sc, RAL_STA_CSR0, sc->sta, sizeof sc->sta);
2057 
2058 	ural_set_txantenna(sc, sc->tx_ant);
2059 	ural_set_rxantenna(sc, sc->rx_ant);
2060 
2061 	ural_set_macaddr(sc, vap ? vap->iv_myaddr : ic->ic_macaddr);
2062 
2063 	/*
2064 	 * Allocate Tx and Rx xfer queues.
2065 	 */
2066 	ural_setup_tx_list(sc);
2067 
2068 	/* kick Rx */
2069 	tmp = RAL_DROP_PHY | RAL_DROP_CRC;
2070 	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
2071 		tmp |= RAL_DROP_CTL | RAL_DROP_BAD_VERSION;
2072 		if (ic->ic_opmode != IEEE80211_M_HOSTAP)
2073 			tmp |= RAL_DROP_TODS;
2074 		if (ic->ic_promisc == 0)
2075 			tmp |= RAL_DROP_NOT_TO_ME;
2076 	}
2077 	ural_write(sc, RAL_TXRX_CSR2, tmp);
2078 
2079 	sc->sc_running = 1;
2080 	usbd_xfer_set_stall(sc->sc_xfer[URAL_BULK_WR]);
2081 	usbd_transfer_start(sc->sc_xfer[URAL_BULK_RD]);
2082 	return;
2083 
2084 fail:	ural_stop(sc);
2085 }
2086 
2087 static void
2088 ural_stop(struct ural_softc *sc)
2089 {
2090 
2091 	RAL_LOCK_ASSERT(sc, MA_OWNED);
2092 
2093 	sc->sc_running = 0;
2094 
2095 	/*
2096 	 * Drain all the transfers, if not already drained:
2097 	 */
2098 	RAL_UNLOCK(sc);
2099 	usbd_transfer_drain(sc->sc_xfer[URAL_BULK_WR]);
2100 	usbd_transfer_drain(sc->sc_xfer[URAL_BULK_RD]);
2101 	RAL_LOCK(sc);
2102 
2103 	ural_unsetup_tx_list(sc);
2104 
2105 	/* disable Rx */
2106 	ural_write(sc, RAL_TXRX_CSR2, RAL_DISABLE_RX);
2107 	/* reset ASIC and BBP (but won't reset MAC registers!) */
2108 	ural_write(sc, RAL_MAC_CSR1, RAL_RESET_ASIC | RAL_RESET_BBP);
2109 	/* wait a little */
2110 	ural_pause(sc, hz / 10);
2111 	ural_write(sc, RAL_MAC_CSR1, 0);
2112 	/* wait a little */
2113 	ural_pause(sc, hz / 10);
2114 }
2115 
2116 static int
2117 ural_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
2118 	const struct ieee80211_bpf_params *params)
2119 {
2120 	struct ieee80211com *ic = ni->ni_ic;
2121 	struct ural_softc *sc = ic->ic_softc;
2122 
2123 	RAL_LOCK(sc);
2124 	/* prevent management frames from being sent if we're not ready */
2125 	if (!sc->sc_running) {
2126 		RAL_UNLOCK(sc);
2127 		m_freem(m);
2128 		return ENETDOWN;
2129 	}
2130 	if (sc->tx_nfree < RAL_TX_MINFREE) {
2131 		RAL_UNLOCK(sc);
2132 		m_freem(m);
2133 		return EIO;
2134 	}
2135 
2136 	if (params == NULL) {
2137 		/*
2138 		 * Legacy path; interpret frame contents to decide
2139 		 * precisely how to send the frame.
2140 		 */
2141 		if (ural_tx_mgt(sc, m, ni) != 0)
2142 			goto bad;
2143 	} else {
2144 		/*
2145 		 * Caller supplied explicit parameters to use in
2146 		 * sending the frame.
2147 		 */
2148 		if (ural_tx_raw(sc, m, ni, params) != 0)
2149 			goto bad;
2150 	}
2151 	RAL_UNLOCK(sc);
2152 	return 0;
2153 bad:
2154 	RAL_UNLOCK(sc);
2155 	return EIO;		/* XXX */
2156 }
2157 
2158 static void
2159 ural_ratectl_start(struct ural_softc *sc, struct ieee80211_node *ni)
2160 {
2161 	struct ieee80211vap *vap = ni->ni_vap;
2162 	struct ural_vap *uvp = URAL_VAP(vap);
2163 
2164 	/* clear statistic registers (STA_CSR0 to STA_CSR10) */
2165 	ural_read_multi(sc, RAL_STA_CSR0, sc->sta, sizeof sc->sta);
2166 
2167 	usb_callout_reset(&uvp->ratectl_ch, hz, ural_ratectl_timeout, uvp);
2168 }
2169 
2170 static void
2171 ural_ratectl_timeout(void *arg)
2172 {
2173 	struct ural_vap *uvp = arg;
2174 	struct ieee80211vap *vap = &uvp->vap;
2175 	struct ieee80211com *ic = vap->iv_ic;
2176 
2177 	ieee80211_runtask(ic, &uvp->ratectl_task);
2178 }
2179 
2180 static void
2181 ural_ratectl_task(void *arg, int pending)
2182 {
2183 	struct ural_vap *uvp = arg;
2184 	struct ieee80211vap *vap = &uvp->vap;
2185 	struct ieee80211com *ic = vap->iv_ic;
2186 	struct ural_softc *sc = ic->ic_softc;
2187 	struct ieee80211_node *ni;
2188 	int ok, fail;
2189 	int sum, retrycnt;
2190 
2191 	ni = ieee80211_ref_node(vap->iv_bss);
2192 	RAL_LOCK(sc);
2193 	/* read and clear statistic registers (STA_CSR0 to STA_CSR10) */
2194 	ural_read_multi(sc, RAL_STA_CSR0, sc->sta, sizeof(sc->sta));
2195 
2196 	ok = sc->sta[7] +		/* TX ok w/o retry */
2197 	     sc->sta[8];		/* TX ok w/ retry */
2198 	fail = sc->sta[9];		/* TX retry-fail count */
2199 	sum = ok+fail;
2200 	retrycnt = sc->sta[8] + fail;
2201 
2202 	ieee80211_ratectl_tx_update(vap, ni, &sum, &ok, &retrycnt);
2203 	(void) ieee80211_ratectl_rate(ni, NULL, 0);
2204 
2205 	/* count TX retry-fail as Tx errors */
2206 	if_inc_counter(ni->ni_vap->iv_ifp, IFCOUNTER_OERRORS, fail);
2207 
2208 	usb_callout_reset(&uvp->ratectl_ch, hz, ural_ratectl_timeout, uvp);
2209 	RAL_UNLOCK(sc);
2210 	ieee80211_free_node(ni);
2211 }
2212 
2213 static int
2214 ural_pause(struct ural_softc *sc, int timeout)
2215 {
2216 
2217 	usb_pause_mtx(&sc->sc_mtx, timeout);
2218 	return (0);
2219 }
2220